From 4405b632e3da839defec966e4b0be44d0c5e3102 Mon Sep 17 00:00:00 2001
From: Dedy Lansky <dlansky@codeaurora.org>
Date: Thu, 23 Aug 2018 14:47:13 +0300
Subject: [PATCH] wil6210: fix invalid memory access for rx_buff_mgmt debugfs
Git-commit: 4405b632e3da839defec966e4b0be44d0c5e3102
Patch-mainline: v4.20-rc1
References: bsc#1111666
Check rx_buff_mgmt is allocated before accessing its internal fields.
Signed-off-by: Dedy Lansky <dlansky@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
drivers/net/wireless/ath/wil6210/debugfs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 6973333497c1..965c61be8b79 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -1237,6 +1237,9 @@ static int wil_rx_buff_mgmt_debugfs_show(struct seq_file *s, void *data)
int num_active;
int num_free;
+ if (!rbm->buff_arr)
+ return -EINVAL;
+
seq_printf(s, " size = %zu\n", rbm->size);
seq_printf(s, " free_list_empty_cnt = %lu\n",
rbm->free_list_empty_cnt);
--
2.16.4